United States Patent and Trademark Office 



UNITED STATES DEl'AKTMEN 1 OF COMMERCE 
1'nikil States l'atint and Trademark Office 

Address: COMMISSIONER FOR PATENTS 



NOTICE OF ALLOWANCE AND FEE(S) DUE 



DAVIS, ZACHARY A 



LEE & HAYES PLLC 

421 W RIVERSIDE AVENUE SUITE 500 j artunit I papernumber 
SPOKANE, WA 9920 1 1 — 1 



DATE MAILED: 10/14/2008 



| APPLICATION NO. | FILING DATE J FIRST NAMED INVENTOR | ATTORNEY DOCKET NO. | CONFIRMATION NO. 

10/608,653 06/27/2003 Dinarte R. Morais MS1-1430US 7042 

TITLE OF INVENTION: SYSTEMS AND METHODS FOR CACHING IN AUTHENTICATION SYSTEMS 



| APPLN. TYPE | SMALL ENTITY | ISSUE FEE DUE | PUBLICATION FEE DUE | PREV. PAID ISSUE FEE | TOTAL FEEfS; DUE | DATE DUE j 

nonprovisional NO $1510 SO $0 $1510 01/14/2009 

THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT. 
PROSECUTION ON THE MERITS JS CLOSED . THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS. 
THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON 
PETITION BY THE APPLICANT. SEE 37 CFR 1.313 AND MPEP 1308. 

THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE 
MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS 
STATUTORY PERIOD CANNOT BE EXTENDED . SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE DOES 
NOT REFLECT A CREDIT FOR ANY PREVIOUSLY PAID ISSUE FEE IN THIS APPLICATION. IF AN ISSUE FEE HAS 
PREVIOUSLY BEEN PAID IN THIS APPLICATION (AS SHOWN ABOVE), THE RETURN OF PART B OF THIS FORM 
WILL BE CONSIDERED A REQUEST TO REAPPLY THE PREVIOUSLY PAID ISSUE FEE TOWARD THE ISSUE FEE NOW 
DUE. 



HOW TO REPLY TO THIS NOTICE: 



I. Review the SMALL ENTITY status shown above. 

If the SMALL ENTITY is shown as YES, verify your current 
SMALL ENTITY status: 

A. If the status is the same, pay the TOTAL FEE(S) DUE shown 
above. 

B. If the status above is to be removed, check box 5b on Part B - 
Fee(s) Transmittal and pay the PUBLICATION FEE (if required) 
and twice the amount of the ISSUE FEE shown above, or 



If the SMALL ENTITY is shown as NO: 



A. Pay TOTAL FEE(S) DUE shown above, or 



B. If applicant claimed SMALL ENTITY status before, or is now 
claiming SMALL ENTITY status, check box 5a on Part B - Fee(s) 
Transmittal and pay the PUBLICATION FEE (if required) and 1/2 
the ISSUE FEE shown above. 



II. PART B - FEE(S) TRANSMITTAL, or its equivalent, must be completed and returned to the United States Patent and Trademark Office 
(USPTO) with your ISSUE FEE and PUBLICATION FEE (if required). If you are charging the fee(s) to your deposit account, section "4b" 
of Part B - Fee(s) Transmittal should be completed and an extra copy of the form should be submitted. If an equivalent of Part B is filed, a 
request to reapply a previously paid issue fee must be clearly made, and delays in processing may occur due to the difficulty in recognizing 
the paper as an equivalent of Part B. 

III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to 
Mail Stop ISSUE FEE unless advised to the contrary. 

IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require payment of 
maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



Page 1 of 3 



PART B - FEE(S) TRANSMITTAL 

Complete and send this form, together with applicable fee(s), to: Mail Mail Stop ISSUE FEE 

Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
or Fax (571)-273-2885 



INSTRUCTIONS: This form should be used for transmitting Ihe ISSl'l: H i and I'UJUCATION 11 J. 
appropriate. All further correspondence im.-Ju<Jint> (he Patent, advance orders and notification of maintcnani 
indicated unless corrected below or directed otherwise in block I. b\ la) spccifung a new cor 
■e lee notifications. ' ' 



required), blocks 1 through 5 should he completed whf 
nee rees will be mailed to the current correspondence address 
e address: and/or (b) indicating a separate "FEE ADDRESS" 1 



be used for domestic mailings of the 
,)t be used for any other accompanying 
n assignment or formal drawing, must 



LEE & HAYES PLLC 

421 W RIVERSIDE AVENUE SUITE 500 

SPOKANE, WA 99201 



fee(s) Transmittal. This certificate c 
papers, bach additional paper, such 
have its own certificate of mailing ot 

Certificate of Mailing or Transmission 

I hereby certih that this feels) Transmittal is being deposited with the United 
Stales Postal Sen ice w ith sufficient postage lor first class mail in an envelope 
addressed to the Mail Slop ISSUE 1 hi. address abo\e. or beiim facsimile 
transmitted to the USPTO (571) 273-2885, on the date indicated below. 



APPLICATION NO. 



HUNG DA Hi 



1 IKS I NAMED INVENTOR 



ATTORNEY DOCKET NO. CONFIRMATION NO. 



10/608,653 06/27/2003 Dinarte R. Morais 

TITLE OF INVENTION: SYSTEMS AND METHODS FOR CACHING IN AUTHENTICATION SYSTEMS 



APPLN. TYPE 



SMALL ENTITY 



ISSUE FEE DUE PUBLICATION FEE DUE I PREV. PAID ISSUE FEE TOTAL FEElS ) Dt IE 



DAVIS, ZACHARY A 



CFR 1.363). 

□ c 



ir indication of "bee Address" (37 



CLASS-SUBCLASS 



2. For printing on the patent front page, list 



(2) the name of a single firm ill. 
registered attorney or agent) anc 
2 registered patent attorney s or a 
listed, no name will be printed. 



3. \ss|(i\| I NAME AND RESIDENCE DA l'A TO BE PRINTED ON TOE PATENT (print or type) 



recordation as 
(A) NAME OF ASSIGNEE 



(B ) RESIDENCE: (CITY and STATE OR COUNTRY) 



Please check the appropriate assignee category or categories (will not be printed on the patent) : Q Individual Q Corporation or other private group entity Q Government 

4a. The following fee(s) are submitted: 4b. Payment of Fee(s ): (Please first reapply any previously paid issue lee shown above) 

Q Issue Fee J A check is enclosed. 

□ Publication Fee (No small entity discount permitted) □ Payment by credit card. Form PTO-2038 is attached. 

Q Advance Order - # of Copies 



overpayment, to Deposit Account Number _ 



5. Change in Entity Status (from status indicated above! 

□ a. Applicant claims SMALL ENTITY status. See 37 CFR 1.27. □ b. Applicant is no longer claiming SMALL ENTITY status. See 37 CFR 1.27(g)(2). 



>r the assignee or other parly in 



Authorized Signature 
Typed or printed name _ 



This collection of infoi mat ion i ; required by 37 CI R 1 .3 I I . The information is required to obtain or retain a benefil by the public which is to file (and by the I 'SPTO to process) 
an application. ( 'onfidcnlialily is gov erned by 3.^ E.S.C. I 22 and 37 ('] R 1 . 14. This collection is estimated to lake 12 minutes to complete, inc hiding gathering, preparing, and 

submitting the compl i d pplicali n I mi th I'SP'I'O fim ill i I | ndin n nil individual n mm nl nth H I m u i quire to complete 

this form and/or susseslions for reducing this burden, should be senl to the ( liiel Information Officer. I .S. Patent and Trademark Office. I \S. Department of Commerce. P.O. 
b< 1450. Alexandria. Vircini 23 1 I45i IX) NOT SUNT) M-J-S OR COMPl-l-TO) I-ORMS TO Till vDDRES 4 1) TO: ( mini ner lor Paten P.O. B 1450 
Alexandria. Virginia 22313-1450. 

Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



OMB 0651-0033 U.S. Patent and Trademark Office: U.S. DEPARTMENT OF COMMERCE 



APPLICATION NO. | FILING DATE j FIRST NAMED INVENTOR | ATTORNEY DOCKET NO. | CONFIRMATION NO. 

10/608,653 06/27/2003 Dinarte R. Morais MS1-1430US 7042 

22801 7590 10/14/2008 I EXAMINER 

LEE & HAYES PLLC davis, zachary a 

421 W RIVERSIDE AVENUE SUITE 500 j art unit ] paper number 
SPOKANE, WA 9920 1 1 — 1 



DATE MAILED: 10/14/2008 



Determination of Patent Term Adjustment under 35 U.S.C. 154 (b) 

(application filed on or after May 29, 2000) 

The Patent Term Adjustment to date is 514 day(s). If the issue fee is paid on the date that is three months after the 
mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half 
months) after the mailing date of this notice, the Patent Term Adjustment will be 514 day(s). 

If a Continued Prosecution Application (CPA) was filed in the above-identified application, the filing date that 
determines Patent Term Adjustment is the filing date of the most recent CPA. 

Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval 
(PAIR) WEB site (http://pair.uspto.gov). 

Any questions regarding the Patent Term Extension or Adjustment determination should be directed to the Office of 
Patent Legal Administration at (571)-272-7702. Questions relating to issue and publication fee payments should be 
directed to the Customer Service Center of the Office of Patent Publication at l-(888)-786-0101 or 
(571)-272-4200. 



PTOL-85 (Rev. 08/07) Approved for use through 08/3 1/2010. 



Page 3 of 3 





Application No. 


Applicant(s) 


Notice of Allowability 


10/608,653 


MORAIS ET AL. 


Examiner 


Art Unit 






Zachary A. Davis 


2437 





~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . |EI This communication is responsive to the RCE and amendment received 23 July 2008. 

2. The allowed claim(s) is/are 16,18-23 and 61-74 . 
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International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
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EXAMINER'S AMENDMENT 
Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 23 July 
2008 has been entered. 

2. By the above submission, Claims 16, 18, 19, 22, 23, 61-63, and 68-74 have been 
amended. No claims have been added or canceled. Claims 16, 18-23, and 61-74 are 
currently pending in the present response. 

Examiner's Amendment 

3. An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with John Meline on 24 September 2008. 
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The application has been amended as follows: 
Please REPLACE the Claims with the following amended full claim listing: 
1-15. (Canceled) 

16. (Currently Amended) A process for verification of a client authentication request 
by a server which can decrease problems associated with sham authentication 
requests, the process comprising: 

receiving, in the server, a client authentication request including client-specific 

data; 

comparing the client specific data to data stored in a first cache memory coupled 
to the server to determine whether the client specific data meet a first threshold of 
validity; 

if compar i ng d e t e rm i n e s that the client specific data meet the first threshold of 
validity, proceeding with the authentication process; and 

if compar i ng d e t e rm i n e s that the client specific data do not meet the first 
threshold of validity, then storing in a second cache memory a portion of the client 
specific data and an indication that the client specific data do not correspond to a valid 
client, wherein the portion of the client specific data and the indication stored in the 
second cache memory identify a client name associated with the client authentication 
request and associate the client name with a negative indication of validity regardless of 
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whether the client specific data includes valid proof of knowledge of privileged data, and 
then terminating the verification process. 

17. (Canceled) 

18. (Previously presented) The process of claim 16, wherein: 

proceeding with the authentication process comprises comparing the client 
specific data with data stored in the second cache memory to determine whether the 
client specific data meet a second threshold of validity and whether the client specific 
data correspond to an identity previously determined to be valid or invalid; 

if the client specific data meet the second threshold, transmitting a request for 
verification to a database containing client specific data; and 

if the client specific data correspond to an identity previously determined to be 
invalid, terminating the authentication request. 

1 9. (Previously presented) The process of claim 1 6, wherein receiving comprises 
receiving data including one or more of: a name, a NameHash, a truncation of a 
NameHash, a NameKeyHash, a truncation of a NameKeyHash, a 
TimedNameKeyHash, a truncation of a TimedNameKeyHash or a time. 

20. (Original) The process of claim 16, wherein receiving comprises receiving a 
TimedNameKeyHash. 
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21 . (Original) The process of claim 16, wherein receiving comprises receiving a 
TimedNameKeyHash and a current time. 

22. (Previously presented) The process of claim 16, wherein comparing the client 
specific data to data stored in the first cache memory comprises comparing a 
TimedNameKeyHash contained in the authentication request to a function of a stored 
NameKeyHash and a current time. 

23. (Currently Amended) The process of claim 1 6, wherein receiving client specific 
data includes receiving a current time, and further comprising determining whether the 
received current time disagrees with another current time used by the authentication 
server, and, wh e n if the received current time and the anoth e r other current time 
disagree, sending the another other current time to an originator of the authentication 
request. 

24-60. (Canceled) 

61 . (Currently Amended) A computer system comprising: 
an authentication server; and 

a first cache memory coupled to the authentication server, wherein the 
authentication server is configured to perform a method, the method comprising: 
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receiving a client authentication request including client-specific data; 

comparing the client specific data to data stored in the first cache memory 
coupled to the authentication server to determine whether the client specific data 
meet a first threshold of validity; 

if compar i ng d e t e rm i n e s that the client specific data do not meet the first 
threshold of validity, torm i nato terminating authentication and deny denying the 
authentication request; 

if compar i ng dotorm i nos that the client specific data meet the first 
threshold of validity, proc ee d proceeding with authentication by comparing the 
client specific data with data stored in a second cache memory to determine 
whether the client specific data meet a second threshold of validity and whether 
the client specific data correspond to an identity previously determined to be valid 
or invalid; 

if the client specific data meet the second threshold, transmitting a request 
for verification to a database containing client-specific data; and 

if the client specific data correspond to an identity previously determined 
to be invalid, terminating the authentication request. 

62. (Previously presented) The computer system of claim 61 , wherein the 
authentication server is configured to employ a first, plaintext portion of the client- 
specific data as a cache key to obtain related encrypted client-specific data from the first 
cache memory. 
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63. (Currently Amended) The computer system of claim 61 , wherein the 
authentication server is further configured to perform steps comprising: storing stor e at 
least a portion of the client specific data in the second cache memory along with an 
indication that the client specific data do not correspond to a valid client if compar i ng 
dotorm i nos that the client specific data do not meet the first threshold. 

64. (Previously Presented) The computer system of claim 61 , wherein the client- 
specific data includes a NameKeyHash that is also a function of time. 

65. (Previously Presented) The computer system of claim 61 , wherein the client- 
specific data includes a TimedNameKeyHash. 

66. (Previously Presented) The computer system of claim 61 , wherein the client 
specific data includes a TimedNameKeyHash and a current time is included with the 
client-specific data. 

67. (Currently amended) The computer system of claim 61 , wherein the client 
specific data stored in the first cache memory comprises a NameKeyHash, and wherein 
the authentication server is further configured to perform steps comprising: forming fern 
a TimedNameKeyHash from the NameKeyHash and to compar e comparing the formed 
TimedNameKeyHash to a portion of the client-specific data. 
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68. (Currently Amended) The computer system of claim 61 A wherein the client 
specific data includes a current time, and wherein the authentication server is further 
configured to perform steps comprising: determining dotorm i no whether the received 
current time disagrees with another current time, the another other current time being 
used by the authentication server, and if the received current time and the another other 
current time disagree, send sending the another other current time to an originator of 
the authentication request. 

69. (Currently Amended) A process for verification of a client authentication request 
by a server which can decrease problems associated with sham authentication 
requests, the process comprising: 

receiving, in the server, a client authentication request including client-specific 
data comprising a name or hash of the name along with a client key or a proof of 
knowledge which identifies the client key; 

comparing the client-specific data to data stored in a first cache memory coupled 
to the server to determine whether the c l i e nt sp e c i f i c client-specific data meet a first 
threshold of validity, wherein the first cache memory stores names and keys of valid 
clients, and wherein the first cache memory uses the name or the hash of the name as 
a cache key to access the first cache memory; 

if compar i ng d e t e rm i n e s that the client-specific data meet the first threshold of 
validity, the first threshold of validity being met when the name and the client key 
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identified in the client authentication request correspond to a valid entry in the first 
cache memory, proceeding with the authentication process; and 

if compar i ng d e t e rm i n e s that the client-specific data do not meet the first 
threshold of validity, then storing the name, the client key, and validity/invalidity 
indicators in a second cache memory, wherein the name stored in the second cache 
memory is associated with a validity indication regardless of whether the client key or 
the proof of knowledge for the client key matches data in an associated authentication 
database, and terminating the verification process. 

70. (Currently Amended) A process for authenticating a user which can decrease 
problems associated with sham authentication requests, the process comprising: 

receiving an authentication request including first client specific data comprising 
at least one of a client name and proof of knowledge of a client key; 

computing a NameHash using the received client name and a random session 

key; 

using data corresponding to the NameHash as a cache key to access first validity 
threshold data from a first cache memory; 

comparing the first validity threshold data to the first client specific data; and 
if compar i ng d e t e rm i n e s that the first client specific data do not meet the first 
threshold of validity, then storing a portion of the client specific data in a second cache 
memory along with an indication that the client specific data do not correspond to a valid 
client, the portion of the client specific data stored in the second cache memory 
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identifying a client name associated with the client authentication request and 
associating the client name with a validity indication regardless of whether the client 
specific data included valid proof of knowledge of privileged data, and then terminating 
the verification process. 

71 . (Previously presented) The process of claim 70, further comprising, when the first 
validity data do not match the first client data, storing the client key and a 
CredentiallnvalidFlag in the second cache memory. 

72. (Previously presented) The process of claim 70, further comprising, when the first 
validity data do match the first client data, employing the client name as a cache key to 
access second client validity data from the second cache memory. 

73. (Previously presented) The process of claim 70, further comprising, when the first 
validity data do match the first client data, employing the client name as a cache key to 
access second client validity data from the second cache memory, wherein the second 
client validity data comprise a stored copy of a client key. 

74. (Previously presented) The process of claim 70, wherein using data 
corresponding to the NameHash as a cache key comprises using a truncation of the 
NameHash to access first validity threshold data from the first cache memory. 
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Allowable Subject Matter 

4. Claims 16, 18-23, and 61-74 are allowed. 

5. The following is an examiner's statement of reasons for allowance: 
Independent Claims 16, 61, 69, and 70 are generally directed to methods for 

verifying authentication requests or specifically authenticating users, and corresponding 
systems. Each independent Claim generally recites using both first and second cache 
memories in the method or system. For example, Claim 16 recites checking a request 
for validity against a first cache, and then storing data in the second cache that indicates 
that the client name is not valid if a first validity threshold is not met. Further, dependent 
Claim 18 and independent Claims 61, 69, and 70 each additionally recite storing data in 
the second cache that indicates that the client name is valid if the first threshold of 
validity is met even if a second threshold of validity, such as a proof of knowledge, is not 
met. The Newcombe reference discloses general methods for verification of a client 
request as previously described. The Chang reference generally discloses the use of 
cache memories for validation purposes as previously described. The Kou reference 
(previously cited but not relied upon) also generally discloses verification of client 
authentication requests that includes generation of a cookie for registered clients. The 
above references are considered the closest prior art. However, none of Newcombe, 
Chang, and Kou, alone or in combination, explicitly teach or suggest all of the limitations 
of the independent claims, in particular the use of two cache memories, where data in a 
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request is checked for validity against a first cache and then data is stored in the second 
cache even if validation fails, to indicate whether or not the client name is a valid name. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 



Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571)272- 
3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Emmanuel L. Moise/ /ZAD/ 

Supervisory Patent Examiner, Art Unit 2437 Examiner, Art Unit 2437 



